Bug 1589651 – CVE-2018-1139 samba: Weak authentication protocol regression

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1589651 - (CVE-2018-1139) CVE-2018-1139 samba: Weak authentication protocol regression

Summary:	CVE-2018-1139 samba: Weak authentication protocol regression

Status:	NEW

Aliases:	CVE-2018-1139

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180816,repor...
Keywords:	Security

Depends On:	1617915 1614265 1614744 1617916
Blocks:	1577167
	Show dependency tree / graph

Reported:	2018-06-11 01:38 EDT by Huzaifa S. Sidhpurwala
Modified:	2018-10-30 03:26 EDT (History)
CC List:	17 users (show)

See Also:
Fixed In Version:	samba 4.7.9, samba 4.8.4
Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:2612	None	None	None	2018-09-04 02:31 EDT
Red Hat Product Errata	RHSA-2018:2613	None	None	None	2018-09-04 02:29 EDT
Red Hat Product Errata	RHSA-2018:3056	None	None	None	2018-10-30 03:26 EDT

Groups: None (edit)

Description Huzaifa S. Sidhpurwala 2018-06-11 01:38:10 EDT

As per upstream advisory:

Samba releases 4.7.0 to 4.8.0 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport, even when NTLMv1 is explicitly disabled. This problem does not occur over SMB2, it is a SMB1-only issue.

Normally, the use of NTLMv1 is disabled by default in favor of NTLMv2. This has been the default since Samba 4.5. A code restructuring in the NTLM authentication implementation of Samba in 4.7.0 caused this regression to occur.

Comment 2 Huzaifa S. Sidhpurwala 2018-06-11 01:45:40 EDT

Acknowledgments:

Name: Vivek Das (Red Hat)

Comment 4 Sam Fowler 2018-08-15 23:32:02 EDT

External Reference:

https://www.samba.org/samba/security/CVE-2018-1139.html

Comment 5 Sam Fowler 2018-08-16 03:14:30 EDT

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1617916]

Comment 7 errata-xmlrpc 2018-09-04 02:29:23 EDT

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 7

Via RHSA-2018:2613 https://access.redhat.com/errata/RHSA-2018:2613

Comment 8 errata-xmlrpc 2018-09-04 02:31:46 EDT

This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.4 for RHEL 6

Via RHSA-2018:2612 https://access.redhat.com/errata/RHSA-2018:2612

Comment 9 errata-xmlrpc 2018-10-30 03:26:24 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3056 https://access.redhat.com/errata/RHSA-2018:3056

Note You need to log in before you can comment on or make changes to this bug.